Add a patches-import subcommand as a way to support discovering patches from dependencies

[cweagans]

Verification

• I have updated Composer to the most recent stable release (composer self-update)
• I have updated Composer Patches to the most recent stable release (composer update cweagans/composer-patches)
• I am using one of the supported PHP versions (8.0+)
• I have searched existing issues and discussions for my idea.

Is your feature request related to a problem?

Right now, including patches from dependencies isn't a supported workflow. Many users rely on this functionality.

Describe your proposed solution(s)

Let's add a subcommand to this project that looks through all composer.json files in the project and imports all of the patch definitions into a root-level patches.json. We'll need some way to differentiate between user-added patches and patches defined by a dependency. If the command is re-run, any updated patches from dependencies should be re-discovered. It might make sense to make this a separate patches file.

This removes a ton of the complexity around discovering and applying patches from dependencies and is a workflow that I might be willing to support in the long term.

The workflow would be roughly as follows:

1. composer install - get all of the dependencies on disk
2. composer patches-import - crawl through all of the composer.json files, grab patch defs, and add them to a patches file
3. composer patches-relock - re-generate the patches lock file
4. composer patches-repatch - remove and re-patch installed dependencies

To composer patches, this would just look like you defined the patches by hand. The only real difference is that there would be a helper command that you can run separately from composer install.

Describe alternatives

No response

Additional context

No response

[github-actions]

👋 Thanks for the idea! Please remember that this is an open source project - feature requests may or may not be implemented, and if they are, the timeline is unknown. If you need a guaranteed implementation or timeline, sponsorships are welcome!

[mxr576]

1. How can we opt-out from discovering/applying patches from dependency X with this feature?

How can we exclude all patches from dependency X or just some of them? I assume the generated "patch collection file" could be modified manually but on the next run composer patches-import would automatically add them back.

2. How can we validate if existing dependencies did not introduce a new or a modified patch after a dependency update?

Maybe a composer validate extension could also come handy for this purpose?

Maybe it is also worth collecting user-story-like scenario descriptions that would detail how these commands could/should be leveraged when:

• new dependencies are installed (incl. transitive dependencies)
• a dependency are updated (incl. transitive ones)
• a dependency is removed

[cweagans]

1. How can we opt-out from discovering/applying patches from dependency X with this feature?

An additional configuration directive could be added to ignore patches from specific dependencies. I don't think I'd be interested in ignoring specific patches from specific dependencies (the workaround being to ignore the entire dependency and manage the patches in the root project manually).

2. How can we validate if existing dependencies did not introduce a new or a modified patch after a dependency update?

Since the patches-import subcommand would be modifying a real file at the root of your project, this change would a) be visible through git status or similar and b) only take place after taking an explicit action in your project.

Maybe it is also worth collecting user-story-like scenario descriptions that would detail how these commands could/should be leveraged when:

I specifically do not want this to be an automatic thing by default. If people want to add this to their post-update-cmd scrips, they can do that. I do not want to make any assumptions about how/when patches are imported from dependencies.

That said, I can add some stuff to the Recommended Workflows docs for users that need something a little more prescriptive.

[cweagans]

Actually. Ignore this entire issue.

#547